What if JS over gemini:// would only be able to render some things and would not have network access?
It just is a question of what your html renderer allows.
Add Lua if you think that's better!
But you will have the same problems if embedded Lua can do network stuff.
...or let's just P2P our Emacsens... the last non divisive browser... :-P